JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 159.203.10.148

159.203.10.148 was found in our database!

This IP was reported 121 times. Confidence of Abuse is 100%: ?

100%

ISP	DigitalOcean, LLC
Usage Type	Data Center/Web Hosting/Transit
ASN	AS14061
Domain Name	digitalocean.com
Country	🇨🇦 Canada
City	Toronto, Ontario

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 159.203.10.148

Whois 159.203.10.148

IP Abuse Reports for 159.203.10.148:

This IP address has been reported a total of 121 times from 44 distinct sources. 159.203.10.148 was first reported on January 7th 2024, and the most recent report was 9 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇩🇪 ghostwarriors	2026-08-24 15:50:07 (9 hours ago)	Attempts against non-existent wp-login	Brute-Force Web App Attack
🇩🇪 louis77	2026-08-24 15:31:37 (10 hours ago)	Sensitive file access attempt - Path: /.git/config, Method: GET, UA: Mozilla/5.0 (Windows NT 10.0; W ... show more Sensitive file access attempt - Path: /.git/config, Method: GET, UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 show less	Web App Attack Hacking
🇬🇧 consul.to	2026-08-24 15:22:10 (10 hours ago)	Web attack/malicious scanning detected	Web App Attack
🇨🇭 4server	2026-08-24 14:30:35 (11 hours ago)	[MonAug2416:30:31.9917282026][security2:error][pid3890936:tid3891159][client159.203.10.148:0]ModSecu ... show more [MonAug2416:30:31.9917282026][security2:error][pid3890936:tid3891159][client159.203.10.148:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".git\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"610\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"aeapcl.ch\"][uri\"/.git/config\"][unique_id\"aoxVh4IMFJxupj_2UnoBvQAAAEk\"] show less	Hacking Web App Attack
🇨🇭 ca	2026-08-24 14:15:18 (11 hours ago)	This IP was detected by CrowdSec triggering crowdsecurity/CVE-2017-9841	Web App Attack
🇩🇪 4server	2026-08-24 14:09:14 (11 hours ago)	[MonAug2416:09:12.3969842026][security2:error][pid1139167:tid1139248][client159.203.10.148:0]ModSecu ... show more [MonAug2416:09:12.3969842026][security2:error][pid1139167:tid1139248][client159.203.10.148:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"acquaallaspina.ch\"][uri\"/.git/config\"][unique_id\"aoxQiAEsgONLjdghH21yLwAAAJQ\"] show less	Port Scan Brute-Force Web App Attack
🇧🇪 voormedia	2026-08-24 14:00:43 (11 hours ago)	Accessed trap at '/.git/config'	Web App Attack
🇭🇺 DumaNet	2026-08-24 03:53:00 (21 hours ago)	Web app attack attempts, scanning for vulnerability. Date: 2026 Aug 23. 12:38:43 Source IP: 159.20 ... show more Web app attack attempts, scanning for vulnerability. Date: 2026 Aug 23. 12:38:43 Source IP: 159.203.10.148 Portion of the log(s): 159.203.10.148 - [23/Aug/2026:12:38:43 +0200] "GET /jquery-file-upload/server/php/ HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" 159.203.10.148 - [23/Aug/2026:12:38:43 +0200] "GET /assets/js/frontend/jquery-file-upload/server/php/ HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" 159.203.10.148 - [23/Aug/2026:12:38:43 +0200] "GET /assets/plugins/jQuery-File-Upload/server/php/ HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36" 159.203.10.148 - [23/Aug/2026:12:38:43 +0200] "GET /file-manager/initialize HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132 show less	Web App Attack
🇫🇷 tecnicorioja	2026-08-23 22:01:48 (1 day ago)	(Mod_security)	Web App Attack Brute-Force Bad Web Bot
🇬🇧 Xiaohack	2026-08-23 11:07:27 (1 day ago)	2026-08-23 13:07:25 WARNING: 404 list at URL: /.git/config - Referrer: No referrer - List: 404 Not F ... show more 2026-08-23 13:07:25 WARNING: 404 list at URL: /.git/config - Referrer: No referrer - List: 404 Not Found: The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again. - IP: 159.203.10.148 - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 [in routes : not_found_error : 40] 2026-08-23 13:07:25 WARNING: 404 list at URL: /.git/config - Referrer: http://xiaohack.es/.git/config - List: 404 Not Found: The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again. - IP: 159.203.10.148 - User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 [in routes : not_found_error : 40] 2026-08-23 13:07:26 WARNING: 404 list at URL: /file-manager/initialize - Referrer: No referrer - List: 404 Not Found: The requested URL was not found on the server ... show less	Open Proxy Bad Web Bot
🇺🇸 TPI-Abuse	2026-08-23 10:50:10 (1 day ago)	(mod_security) mod_security (id:210492) triggered by 159.203.10.148 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210492) triggered by 159.203.10.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 23 06:50:02.545251 2026] [security2:error] [pid 3596:tid 3596] [client 159.203.10.148:53846] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.xarq.es"] [uri "/.git/config"] [unique_id "aorQWoQ0JIVx6CaXD9X9TAAAAAM"] show less	Brute-Force Bad Web Bot Web App Attack
🇧🇪 cmbplf	2026-08-23 10:07:37 (1 day ago)	9.701 4xx requests in 1 hour (2w5d13h)	Brute-Force Bad Web Bot
🇩🇪 Vegascosmetics	2026-08-23 10:07:20 (1 day ago)	Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after PHP/CMS/webshell exploit probe (possi ... show more Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after PHP/CMS/webshell exploit probe (possible exploited host). Evidence: AttackPattern: eval-stdin\.php (Match: eval-stdin.php) show less	Hacking Exploited Host Web App Attack
🇳🇱 Site.eu	2026-08-23 09:59:48 (1 day ago)	Excessive multi-domain requests	Brute-Force
🇩🇪 yvoictra	2026-08-23 09:56:16 (1 day ago)	Bloqueado automáticamente por CrowdSec. Escenario: crowdsecurity/CVE-2017-9841	Brute-Force

Showing 1 to 15 of 121 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇺🇸 207.29.201.130

🇧🇷 205.210.31.202

🇮🇳 203.145.143.163

🇲🇦 197.153.57.103

🇩🇪 193.124.20.254

🇳🇮 190.212.214.63

🇧🇷 189.29.147.96

🇸🇬 172.217.47.22

🇺🇸 161.123.124.10

🇸🇦 149.109.82.153

🇺🇸 146.88.240.182

🇨🇳 114.216.204.34

🇺🇸 104.23.160.55

🇺🇸 103.61.14.139

🇫🇷 91.231.89.102

🇵🇱 91.206.26.26

🇵🇱 87.239.170.66

🇸🇪 83.233.115.222

🇳🇱 45.148.10.157

🇨🇳 218.0.63.25